Released on May 18th, 2026.<\/p>\n
ConnectionCredentials.of()<\/code> method now throws an exception when more than one expiration timestamp property is present in the credentials map. Only a single expiration timestamp is allowed per credentials bundle.<\/li>\nEntity names (namespaces, tables, views, generic tables) submitted to the REST layer are now rejected with HTTP 400 if they are empty, contain a \/<\/code>, or have leading\/trailing whitespace. Clients that were previously able to create such entities must rename them before upgrading.<\/li>\nrenameTable<\/code> now returns HTTP 204 (No Content) instead of 200, as required by the Iceberg REST Catalog spec. Clients that expect a 200 response must be updated.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded summarize subcommand to Polaris CLI.<\/li>\nAdded find and tables options to Polaris CLI.<\/li>\nAdded support for multiple event listeners. Set polaris.event-listener.types<\/code> to a comma-separated list of event listener types to enable multiple event listeners.<\/li>\nAdded support for enabling only a subset of event types and event categories per event listener. Set polaris.event-listener.<\/code><name><\/code><\/em>.enabled-event-types<\/code> or polaris.event-listener.<\/code><name><\/code><\/em>.enabled-event-categories<\/code> to the list of event types or categories for the specified event listener to only consume the selected subset of events.<\/li>\nAdded support for Apache Ranger<\/strong> as an external authorizer (Beta).<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nImproved Python CLI error messages and exit codes for invalid arguments and configuration errors.<\/li>\nRemoved unused PolarisAuthorizableOperation<\/code> values: REVOKE_PRINCIPAL_GRANT_FROM_PRINCIPAL_ROLE<\/code>, REVOKE_PRINCIPAL_ROLE_GRANT_FROM_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_ROOT<\/code>, ADD_PRINCIPAL_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL<\/code>, ADD_PRINCIPAL_ROLE_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL_ROLE<\/code>, ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
\/<\/code>, or have leading\/trailing whitespace. Clients that were previously able to create such entities must rename them before upgrading.<\/li>\nrenameTable<\/code> now returns HTTP 204 (No Content) instead of 200, as required by the Iceberg REST Catalog spec. Clients that expect a 200 response must be updated.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded summarize subcommand to Polaris CLI.<\/li>\nAdded find and tables options to Polaris CLI.<\/li>\nAdded support for multiple event listeners. Set polaris.event-listener.types<\/code> to a comma-separated list of event listener types to enable multiple event listeners.<\/li>\nAdded support for enabling only a subset of event types and event categories per event listener. Set polaris.event-listener.<\/code><name><\/code><\/em>.enabled-event-types<\/code> or polaris.event-listener.<\/code><name><\/code><\/em>.enabled-event-categories<\/code> to the list of event types or categories for the specified event listener to only consume the selected subset of events.<\/li>\nAdded support for Apache Ranger<\/strong> as an external authorizer (Beta).<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nImproved Python CLI error messages and exit codes for invalid arguments and configuration errors.<\/li>\nRemoved unused PolarisAuthorizableOperation<\/code> values: REVOKE_PRINCIPAL_GRANT_FROM_PRINCIPAL_ROLE<\/code>, REVOKE_PRINCIPAL_ROLE_GRANT_FROM_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_ROOT<\/code>, ADD_PRINCIPAL_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL<\/code>, ADD_PRINCIPAL_ROLE_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL_ROLE<\/code>, ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
renameTable<\/code> now returns HTTP 204 (No Content) instead of 200, as required by the Iceberg REST Catalog spec. Clients that expect a 200 response must be updated.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded summarize subcommand to Polaris CLI.<\/li>\nAdded find and tables options to Polaris CLI.<\/li>\nAdded support for multiple event listeners. Set polaris.event-listener.types<\/code> to a comma-separated list of event listener types to enable multiple event listeners.<\/li>\nAdded support for enabling only a subset of event types and event categories per event listener. Set polaris.event-listener.<\/code><name><\/code><\/em>.enabled-event-types<\/code> or polaris.event-listener.<\/code><name><\/code><\/em>.enabled-event-categories<\/code> to the list of event types or categories for the specified event listener to only consume the selected subset of events.<\/li>\nAdded support for Apache Ranger<\/strong> as an external authorizer (Beta).<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nImproved Python CLI error messages and exit codes for invalid arguments and configuration errors.<\/li>\nRemoved unused PolarisAuthorizableOperation<\/code> values: REVOKE_PRINCIPAL_GRANT_FROM_PRINCIPAL_ROLE<\/code>, REVOKE_PRINCIPAL_ROLE_GRANT_FROM_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_ROOT<\/code>, ADD_PRINCIPAL_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL<\/code>, ADD_PRINCIPAL_ROLE_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL_ROLE<\/code>, ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
envFrom<\/code> support in Helm chart.<\/li>\nAdded summarize subcommand to Polaris CLI.<\/li>\nAdded find and tables options to Polaris CLI.<\/li>\nAdded support for multiple event listeners. Set polaris.event-listener.types<\/code> to a comma-separated list of event listener types to enable multiple event listeners.<\/li>\nAdded support for enabling only a subset of event types and event categories per event listener. Set polaris.event-listener.<\/code><name><\/code><\/em>.enabled-event-types<\/code> or polaris.event-listener.<\/code><name><\/code><\/em>.enabled-event-categories<\/code> to the list of event types or categories for the specified event listener to only consume the selected subset of events.<\/li>\nAdded support for Apache Ranger<\/strong> as an external authorizer (Beta).<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nImproved Python CLI error messages and exit codes for invalid arguments and configuration errors.<\/li>\nRemoved unused PolarisAuthorizableOperation<\/code> values: REVOKE_PRINCIPAL_GRANT_FROM_PRINCIPAL_ROLE<\/code>, REVOKE_PRINCIPAL_ROLE_GRANT_FROM_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_ROOT<\/code>, ADD_PRINCIPAL_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL<\/code>, ADD_PRINCIPAL_ROLE_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL_ROLE<\/code>, ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
polaris.event-listener.types<\/code> to a comma-separated list of event listener types to enable multiple event listeners.<\/li>\nAdded support for enabling only a subset of event types and event categories per event listener. Set polaris.event-listener.<\/code><name><\/code><\/em>.enabled-event-types<\/code> or polaris.event-listener.<\/code><name><\/code><\/em>.enabled-event-categories<\/code> to the list of event types or categories for the specified event listener to only consume the selected subset of events.<\/li>\nAdded support for Apache Ranger<\/strong> as an external authorizer (Beta).<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nImproved Python CLI error messages and exit codes for invalid arguments and configuration errors.<\/li>\nRemoved unused PolarisAuthorizableOperation<\/code> values: REVOKE_PRINCIPAL_GRANT_FROM_PRINCIPAL_ROLE<\/code>, REVOKE_PRINCIPAL_ROLE_GRANT_FROM_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_ROOT<\/code>, ADD_PRINCIPAL_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL<\/code>, ADD_PRINCIPAL_ROLE_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL_ROLE<\/code>, ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
polaris.event-listener.<\/code><name><\/code><\/em>.enabled-event-types<\/code> or polaris.event-listener.<\/code><name><\/code><\/em>.enabled-event-categories<\/code> to the list of event types or categories for the specified event listener to only consume the selected subset of events.<\/li>\nAdded support for Apache Ranger<\/strong> as an external authorizer (Beta).<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nImproved Python CLI error messages and exit codes for invalid arguments and configuration errors.<\/li>\nRemoved unused PolarisAuthorizableOperation<\/code> values: REVOKE_PRINCIPAL_GRANT_FROM_PRINCIPAL_ROLE<\/code>, REVOKE_PRINCIPAL_ROLE_GRANT_FROM_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_ROOT<\/code>, ADD_PRINCIPAL_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL<\/code>, ADD_PRINCIPAL_ROLE_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL_ROLE<\/code>, ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
<name><\/code><\/em>.enabled-event-types<\/code> or polaris.event-listener.<\/code><name><\/code><\/em>.enabled-event-categories<\/code> to the list of event types or categories for the specified event listener to only consume the selected subset of events.<\/li>\nAdded support for Apache Ranger<\/strong> as an external authorizer (Beta).<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nImproved Python CLI error messages and exit codes for invalid arguments and configuration errors.<\/li>\nRemoved unused PolarisAuthorizableOperation<\/code> values: REVOKE_PRINCIPAL_GRANT_FROM_PRINCIPAL_ROLE<\/code>, REVOKE_PRINCIPAL_ROLE_GRANT_FROM_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_ROOT<\/code>, ADD_PRINCIPAL_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL<\/code>, ADD_PRINCIPAL_ROLE_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL_ROLE<\/code>, ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
.enabled-event-types<\/code> or polaris.event-listener.<\/code><name><\/code><\/em>.enabled-event-categories<\/code> to the list of event types or categories for the specified event listener to only consume the selected subset of events.<\/li>\nAdded support for Apache Ranger<\/strong> as an external authorizer (Beta).<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nImproved Python CLI error messages and exit codes for invalid arguments and configuration errors.<\/li>\nRemoved unused PolarisAuthorizableOperation<\/code> values: REVOKE_PRINCIPAL_GRANT_FROM_PRINCIPAL_ROLE<\/code>, REVOKE_PRINCIPAL_ROLE_GRANT_FROM_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_ROOT<\/code>, ADD_PRINCIPAL_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL<\/code>, ADD_PRINCIPAL_ROLE_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL_ROLE<\/code>, ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
polaris.event-listener.<\/code><name><\/code><\/em>.enabled-event-categories<\/code> to the list of event types or categories for the specified event listener to only consume the selected subset of events.<\/li>\nAdded support for Apache Ranger<\/strong> as an external authorizer (Beta).<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nImproved Python CLI error messages and exit codes for invalid arguments and configuration errors.<\/li>\nRemoved unused PolarisAuthorizableOperation<\/code> values: REVOKE_PRINCIPAL_GRANT_FROM_PRINCIPAL_ROLE<\/code>, REVOKE_PRINCIPAL_ROLE_GRANT_FROM_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_ROOT<\/code>, ADD_PRINCIPAL_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL<\/code>, ADD_PRINCIPAL_ROLE_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL_ROLE<\/code>, ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
<name><\/code><\/em>.enabled-event-categories<\/code> to the list of event types or categories for the specified event listener to only consume the selected subset of events.<\/li>\nAdded support for Apache Ranger<\/strong> as an external authorizer (Beta).<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nImproved Python CLI error messages and exit codes for invalid arguments and configuration errors.<\/li>\nRemoved unused PolarisAuthorizableOperation<\/code> values: REVOKE_PRINCIPAL_GRANT_FROM_PRINCIPAL_ROLE<\/code>, REVOKE_PRINCIPAL_ROLE_GRANT_FROM_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_ROOT<\/code>, ADD_PRINCIPAL_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL<\/code>, ADD_PRINCIPAL_ROLE_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL_ROLE<\/code>, ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
.enabled-event-categories<\/code> to the list of event types or categories for the specified event listener to only consume the selected subset of events.<\/li>\nAdded support for Apache Ranger<\/strong> as an external authorizer (Beta).<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nImproved Python CLI error messages and exit codes for invalid arguments and configuration errors.<\/li>\nRemoved unused PolarisAuthorizableOperation<\/code> values: REVOKE_PRINCIPAL_GRANT_FROM_PRINCIPAL_ROLE<\/code>, REVOKE_PRINCIPAL_ROLE_GRANT_FROM_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_ROOT<\/code>, ADD_PRINCIPAL_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL<\/code>, ADD_PRINCIPAL_ROLE_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL_ROLE<\/code>, ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
PolarisAuthorizableOperation<\/code> values: REVOKE_PRINCIPAL_GRANT_FROM_PRINCIPAL_ROLE<\/code>, REVOKE_PRINCIPAL_ROLE_GRANT_FROM_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_ROOT<\/code>, ADD_PRINCIPAL_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL<\/code>, ADD_PRINCIPAL_ROLE_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL_ROLE<\/code>, ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
REVOKE_PRINCIPAL_GRANT_FROM_PRINCIPAL_ROLE<\/code>, REVOKE_PRINCIPAL_ROLE_GRANT_FROM_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_ROOT<\/code>, ADD_PRINCIPAL_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL<\/code>, ADD_PRINCIPAL_ROLE_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL_ROLE<\/code>, ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
REVOKE_PRINCIPAL_ROLE_GRANT_FROM_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_ROOT<\/code>, ADD_PRINCIPAL_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL<\/code>, ADD_PRINCIPAL_ROLE_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL_ROLE<\/code>, ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
LIST_GRANTS_ON_ROOT<\/code>, ADD_PRINCIPAL_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL<\/code>, ADD_PRINCIPAL_ROLE_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL_ROLE<\/code>, ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
ADD_PRINCIPAL_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL<\/code>, ADD_PRINCIPAL_ROLE_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL_ROLE<\/code>, ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
LIST_GRANTS_ON_PRINCIPAL<\/code>, ADD_PRINCIPAL_ROLE_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL_ROLE<\/code>, ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
ADD_PRINCIPAL_ROLE_GRANT_TO_PRINCIPAL_ROLE<\/code>, LIST_GRANTS_ON_PRINCIPAL_ROLE<\/code>, ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
LIST_GRANTS_ON_PRINCIPAL_ROLE<\/code>, ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
ADD_CATALOG_ROLE_GRANT_TO_CATALOG_ROLE<\/code>, REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
REVOKE_CATALOG_ROLE_GRANT_FROM_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
LIST_GRANTS_ON_CATALOG_ROLE<\/code>, LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
LIST_GRANTS_ON_CATALOG<\/code>, LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
LIST_GRANTS_ON_NAMESPACE<\/code>, LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
LIST_GRANTS_ON_TABLE<\/code>, LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
LIST_GRANTS_ON_VIEW<\/code>.<\/li>\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nAdded client id collision check during reset.<\/li>\nThe ExternalCatalogFactory interface has been renamed to FederatedCatalogFactory. Its createCatalog() and createGenericCatalog() method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
polaris.event-listener.type<\/code> is deprecated and will be removed later. Please use polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
polaris.event-listener.types<\/code> instead.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.1","link":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.1\/","description":"Released on May 1st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nFixes\ud83d\udd17<\/a>\n<\/h4>\nThis release fixes 4 security issues:<\/p>\n\nCVE-2026-42809<\/a><\/li>\nCVE-2026-42810<\/a><\/li>\nCVE-2026-42811<\/a><\/li>\nCVE-2026-42812<\/a><\/li>\n<\/ul>"},{"title":"Apache Polaris 1.4.0","link":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.4.0\/","description":"Released on April 21st, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nUpgrade notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe custom token-bucket based rate limiter has been replaced with Guava’s rate limiter implementation.<\/li>\nThe Helm chart now includes a JSON schema file for easy validation of values files. Because types\nare now validated, existing values files may need to be updated to match the new schema.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\nThe (Before\/After)CommitViewEvent has been removed.<\/li>\nThe (Before\/After)CommitTableEvent has been removed.<\/li>\nThe PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
Released on May 1st, 2026.<\/p>\n
This release fixes 4 security issues:<\/p>\n
Released on April 21st, 2026.<\/p>\n
PolarisMetricsReporter.reportMetric()<\/code> method signature has been extended to include a receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
receivedTimestamp<\/code> parameter of type java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
java.time.Instant<\/code>.<\/li>\nThe ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
ExternalCatalogFactory.createCatalog()<\/code> and createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
createGenericCatalog()<\/code> method signatures have been extended to include a catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
catalogProperties<\/code> parameter of type Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
Map<String, String><\/code> for passing through proxy and timeout settings to federated catalog HTTP clients.<\/li>\nMetrics reporting now requires the TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
TABLE_READ_DATA<\/code> privilege on the target table for read (scan) metrics and TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
TABLE_WRITE_DATA<\/code> for write (commit) metrics.<\/li>\nThe REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
REVOKE_CATALOG_ROLE_FROM_PRINCIPAL_ROLE<\/code> operation no longer requires the PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
PRINCIPAL_ROLE_MANAGE_GRANTS_FOR_GRANTEE<\/code> privilege. Only CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
CATALOG_ROLE_MANAGE_GRANTS_ON_SECURABLE<\/code> on the catalog role is now required, making revoke symmetric with assign. This allows catalog administrators to fully manage catalog role assignments without requiring elevated privileges on principal roles.<\/li>\n<\/ul>\nNew Features\ud83d\udd17<\/a>\n<\/h4>\n\nAdded envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
envFrom<\/code> support in Helm chart.<\/li>\nAdded deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
deploymentAnnotations<\/code> support in Helm chart.<\/li>\nAdded KMS properties (optional) to catalog storage config to enable S3 data encryption.<\/li>\nAdded topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
topologySpreadConstraints<\/code> support in Helm chart.<\/li>\nAdded priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
priorityClassName<\/code> support in Helm chart.<\/li>\nAdded support for including principal name in subscoped credentials. INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
INCLUDE_PRINCIPAL_NAME_IN_SUBSCOPED_CREDENTIAL<\/code> (default: false) can be used to toggle this feature. If enabled, cached credentials issued to one principal will no longer be available for others.<\/li>\nAdded per-field selection for AWS STS session tags in credential vending. The new SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> configuration accepts a comma-separated list of fields to include as session tags (supported: realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
realm<\/code>, catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
catalog<\/code>, namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
namespace<\/code>, table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
table<\/code>, principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
principal<\/code>, roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
roles<\/code>, trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
trace_id<\/code>). This replaces the previous INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL<\/code> and INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
INCLUDE_TRACE_ID_IN_SESSION_TAGS<\/code> boolean flags. Selecting only the fields needed helps avoid AWS STS packed policy size limit errors (2048 characters) caused by long namespace paths. Note: including trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
trace_id<\/code> disables credential caching, which may increase STS calls and latency.<\/li>\nAdded support for Kubernetes Gateway API<\/a> to the Helm Chart.<\/li>\nAdded hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
hierarchical<\/code> flag to AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
AzureStorageConfigInfo<\/code> to allow more precise SAS token down-scoping in ADLS when\nthe hierarchical namespace<\/a>\nfeature is enabled in Azure.<\/li>\nRelaxed client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
client_id<\/code>, client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
client_secret<\/code> regex\/pattern validation on reset endpoint call<\/li>\nAdded support for S3-compatible storage that does not have KMS (use kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
kmsUavailable: true<\/code> in catalog storage configuration)<\/li>\nAdded support for storage-scoped AWS credentials, allowing different AWS credentials to be configured per named storage. Enable with the RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
RESOLVE_CREDENTIALS_BY_STORAGE_NAME<\/code> feature flag (default: false). Storage names can be set explicitly via the storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
storageName<\/code> field on storage configuration, or inferred from the first allowed location’s host.<\/li>\nAdded support for persisting Iceberg metrics (ScanReport, CommitReport) to the database. Enable by setting polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
polaris.iceberg-metrics.reporting.type=persisting<\/code> in configuration. Metrics tables are included in the main JDBC schema.<\/li>\nAdded setup options to Polaris CLI.<\/li>\nAdded CockroachDB as a supported database for the relational JDBC persistence backend. Set polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
polaris.persistence.relational.jdbc.database-type<\/code> to cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
cockroachdb<\/code> to get started.<\/li>\n<\/ul>\nChanges\ud83d\udd17<\/a>\n<\/h4>\n\nChanged deprecated APIs in JUnit 5. This change will force downstream projects that pull in the Polaris test packages to adopt JUnit 6.<\/li>\nThe gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
gcpServiceAccount<\/code> configuration value now affects Polaris behavior (enables service account impersonation). This value was previously defined but unused. This change may affect existing deployments that have populated this property.<\/li>\n(Before\/After)UpdateTableEvent is emitted for all table updates within a transaction.<\/li>\nAdded KMS options to Polaris CLI.<\/li>\nChanged from Poetry to UV for Python package management.<\/li>\nExclude KMS policies when KMS is not being used for S3.<\/li>\nImproved default KMS permission handling to better distinguish read-only and read-write access.<\/li>\n<\/ul>\nDeprecations\ud83d\udd17<\/a>\n<\/h4>\n\nThe configuration option polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
polaris.rate-limiter.token-bucket.window<\/code> is no longer supported and should be removed.<\/li>\nPolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
PolarisConfigurationStore<\/code> has been deprecated for removal.<\/li>\n<\/ul>\nFixes\ud83d\udd17<\/a>\n<\/h4>\n\nFixed error propagation in drop operations (dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
dropTable<\/code>, dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
dropView<\/code>, dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
dropNamespace<\/code>). Server errors now return appropriate HTTP status codes based on persistence result instead of always returning NotFound<\/li>\nEnable non-AWS STS role ARNs<\/li>\nHelm chart: fixed a bug that prevented CORS settings to be properly applied. A new setting cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
cors.enabled<\/code> has been introduced in the chart as part of the fix.<\/li>\n<\/ul>"},{"title":"Apache Polaris 1.3.0-incubating","link":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","pubDate":"Mon, 01 Jan 0001 00:00:00 +0000","guid":"https:\/\/polaris.apache.org\/downloads\/1.3.0\/","description":"Released on January 16th, 2026.<\/p>\nDownloads\ud83d\udd17<\/a>\n<\/h3>\n\n \n \n Artifact<\/th>\n PGP Sig<\/th>\n SHA-512<\/th>\n <\/tr>\n <\/thead>\n \n \n source tar.gz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary tgz<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n binary zip<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.12 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n \n Spark 3.5 with Scala 2.13 Client Jar<\/a><\/td>\n .asc<\/a><\/td>\n .sha512<\/a><\/td>\n <\/tr>\n <\/tbody>\n<\/table>\nRelease Notes\ud83d\udd17<\/a>\n<\/h3>\nHighlights\ud83d\udd17<\/a>\n<\/h4>\n\nSupport for Iceberg Metrics Reporting<\/a> has been introduced in Polaris. Out of the box, metrics can be printed to the logs by setting the org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
Released on January 16th, 2026.<\/p>\n
org.apache.polaris.service.reporting<\/code> logger level to INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
INFO<\/code> (it’s set to OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
OFF<\/code> by default). Custom reporters can be implemented and configured to send metrics to external systems for further analysis and monitoring.<\/li>\nSupport for Open Policy Agent (OPA)<\/a> integration has been added to Polaris. This enables delegating authorization decisions to external policy decision points, allowing organizations to centralize policy management and implement complex authorization rules. OPA integration can be enabled by setting polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
polaris.authorization.type=opa<\/code> in the Polaris configuration.<\/li>\n<\/ul>\nUpgrade Notes\ud83d\udd17<\/a>\n<\/h4>\n\nThe legacy management endpoints at \/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
\/metrics<\/code> and \/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
\/healthcheck<\/code> have been removed. Please use the standard management endpoints at \/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
\/q\/metrics<\/code> and \/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n
\/q\/health<\/code> instead.<\/li>\n<\/ul>\nBreaking changes\ud83d\udd17<\/a>\n<\/h4>\n\n